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United  States 

General  Accounting  Office 

Washington,  D.C.  20548 


Information  Management  and 
Technology  Division 

B-248820 

July  9,  1992 

The  Honorable  John  P.  Murtha 
Chairman,  Subcommittee  on  Defense 
Committee  on  Appropriations 
House  of  Representatives 


Dear  Mr.  Chairman: 


This  report  responds  to  your  request  for  information  on  the  Department  of 
the  Air  Force’s  acquisition  of  the  Survivable  Communications  Integration 
System  (SCIS).  Specifically,  you  asked  for  information  on  program  cost  and 
schedule  overruns,  and  the  status  of  design  and  development  activities  that 
affect  SCIS’  ability  to  satisfy  the  Department  of  Defense’s  attack  warning 
and  attack  assessment  communications  requirements.  Earlier  this  year,  we 
briefed  your  staff  on  the  results  of  our  review.  This  report  provides  the 
details  of  that  briefing.  Appendix  I  contains  our  objectives,  scope,  and 
methodology,  briefing  charts,  and  explanatory  narrative  for  each  chart. 


Background 


SCIS  is  planned  to  be  an  automated  communications  system  that  will 
process  and  simultaneously  send  missile  attack  warning  messages  across 
different  media  to  national  decision  makers.  The  system  is  being  built  as 
part  of  the  Cheyenne  Mountain  Upgrade  program  to  modernize  the 
Integrated  Tactical  Warning  and  Attack  .^sessment  system,  which  is  used 
to  support  information  processing  needs  for  the  North  American 
Aerospace  Defense  Command  (norad),  norad  is  responsible  for  warning 
United  States  and  Canadian  leaders  that  North  America  is  under  attack.  The 
command  and  control  center  for  NORAD  is  the  Cheyenne  Mountain  Air 
Force  Base,  Colorado,  which  houses  data  processing  and  communications 
equipment  supporting  the  tactical  warning  and  attack  assessment  mission. 

Existing  space-  and  ground-based  sensor  technology  enables  NORAD  to 
identify  missiles  launched  from  anywhere  in  the  world.  Currently,  if 
missiles  are  launched,  warning  information  can  be  sent  over  1  of  2 
communication  media— commercial  high  speed  telephone  lines  (CHS)  or 
the  Jam  Resistant  Secure  Communications  (JRSC)  satellite  system— as 
discrete  messages  to  Cheyenne  Mountain  and  other  corranand  centers. 
Discrete  messages  contain  information  about  each  missile  or  warhead 
observed  by  the  sensors,  including  launch  time,  latitude,  longitude,  and 
predicted  location  and  time  of  impact.  Once  received  at  Cheyenne 
Mountain,  the  information  is  further  processed  and  disseminated  to  various 
National  Command  Authority  locations  for  use  in  defending  our  continent. 
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The  current  system  cannot  send  messages  concurrently  over  both  media— a 
limitation  that  influenced  the  Air  Force  to  develop  a  more  survivable 
system,  one  that  can  send  messages  over  many  media  at  the  same  time. 
That  system  is  scis.  It  is  being  designed  and  developed  to  process  missile 
attack  warning  messages  and  provide  highly-survivable  communications 
through  the  use  of  multiple  communications  media  over  which  messages 
will  be  sent  concurrently,  thus  increasing  the  likelihood  that  attack 
messages  will  be  received  even  if  one  or  more  media  become  inoperable. 
SCIS  also  will  create  summary  messages,  a  grouping  of  discrete  messages 
processed  at  regular  time  intervals,  which  provide  general  information 
such  as  the  total  number  of  missiles  launched,  the  number  of  laimches 
from  each  launch  area,  the  number  of  missiles  expected  to  hit  different 
areas,  and  the  initial  predicted  time  of  impact  for  each  target  area. 


Results  in  Brief 


Management  and  development  problems  with  the  SCIS  program  have 
contributed  to  a  65-percent  increase  in  program  costs  (from  $142  million 
to  $234  million)  and  a  3-year  delay  in  completion  (from  1992  to  1995). 
After  working  on  SCIS  for  4  years,  the  prime  contractor  was  unable  to 
deliver  a  system  that  could  process  sensor  data  fast  enough  to  meet  Air 
Force  specifications.  To  help  solve  the  problem,  the  Air  Force  is  allowing 
the  contractor  to  replace  the  computer  platform,  for  the  second  time  at 
government  expense,  with  a  faster,  more  powerfid  model. 

Further,  the  Air  Force  has  reduced  the  number  of  communications  media 
to  be  used  from  five  to  three,  thus  reducing  its  survivability— a  key  factor 
for  its  justification.  Of  the  three  remaining  media,  two  (CHS  and  jrsc)  are 
already  available  for  communicating  missile  warning  messages;  the  third 
(milstar)  is  not  expected  to  be  operational  until  several  years  after  SCIS  is 
delivered. 

According  to  the  Air  Force,  CHS  in  aU  likeUhood  will  be  the  first  medium  to 
go  down  during  a  nuclear  attack.  If  a  nuclear  confrontation  should  occur 
before  MILSTAR  becomes  operational,  JRSC  will  be  the  only  medium 
available  to  transmit  attack  warning  messages. 


As  requested,  we  did  not  provide  a  draft  of  this  report  to  the  Department  of 
Defense  for  review  and  comment.  Instead,  we  discussed  the  information 
contained  in  it  with  appropriate  Defense  and  contractor  program  officials 
including  the  Director,  Strategic  and  Theater  Nuclear  Forces  for 
Command,  Control,  and  Communications  and  the  Cheyenne  Mountain 
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Upgrade  Program  Monitor.  These  officials  generally  agreed  with  our  facts, 
and  we  incorporated  their  views  where  appropriate.  We  performed  our 
work  in  accordance  with  generally  accepted  government  auditing 
standards,  from  June  1991  to  Jime  1992. 

We  are  providing  copies  of  this  report  to  the  Secretary  of  Defense;  the 
Secretary  of  the  Air  Force;  the  Director,  Office  of  Management  and  Budget; 
appropriate  House  and  Senate  Committees;  and  other  interested  parties. 
We  wUl  also  make  copies  available  to  others  upon  request.  Should  you  have 
any  questions  about  this  report,  please  contact  me  at  (202)  512-6240.  The 
major  contributors  to  this  report  are  Usted  in  appendix  II. 

Sincerely  yours. 


Samuel  W.  Bowlin 
Director,  Defense  and  Security 
Information  Systems 
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Abbreviations 

AFSATCOM  Air  Force  Satellite  Communications 

CHS  commercial  high  speed  telephone  lines 

GAO  General  Accounting  Office 

GWEN  Ground  Wave  Emergency  Network 

IMTEC  Information  Management  and  Technology  Division 

JRSC  Jam  Resistant  Secure  Communications 

MILSTAR  Military  Strategic  Tactical  and  Relay  Satellite  Communications 

NORAD  North  American  Aerospace  Defense  Command 

SCIS  Survivable  Communications  Integration  System 
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Briefing  Charts  and  Explanatory  Narrative 


GAO  Introduction 

Objectives/Scope/Methodology 


Objectives 

•  Provide  information  on  program 
cost  and  schedule;  identify 
design  and  development 
deficiencies 


Scope  and  Methodology 
•  Interviewed  program  and 
contractor  officials  and 
reviewed  and  analyzed 
applicable  documents 
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Objectives,  Scope,  and 
Methodology 


The  Chairman,  Subcommittee  on  Defense,  House  Committee  on 
Appropriations,  requested  that  we  obtain  information  on  the  status  of  SCIS’ 
program  costs  and  completion  schedule,  and  on  design  and  development 
deficiencies  that  may  affect  SCIS’  ability  to  communicate  critical  missile 
warning  messages. 


We  obtained  cost  and  schedule  documentation  from  the  Air  Force’s 
Electronic  Systems  Center  and  from  the  SCIS  Program  Element  Monitor  in 
Washington,  D.C.  Information  on  design  and  development  deficiencies  was 
obtained  by  interviewing  program  officials  and  reviewing  applicable 
documentation  from  (1)  the  U.S.  Space  Command,  the  user  of  the  system; 
(2)  the  Air  Force  Space  Command,  the  operator  of  the  system;  (3)  the 
Electronic  Systems  Center,  the  Air  Force  acquisition  component 
responsible  for  designing,  developing,  and  acquiring  the  system;  and  (4) 
the  ECI  Division  of  E-Systems,  Inc.,  the  prime  contractor. 


We  performed  our  work  at  Air  Force  headquarters,  Washington,  D.C.;  U.S. 
Space  Command  and  Air  Force  Space  Command,  Colorado  Springs, 
Colorado;  Air  Force  Materiel  Command’s  Electronic  Systems  Center, 
Hanscom  Air  Force  Base,  Bedford,  Massachusetts;  Carnegie  Mellon’s 
Software  Engineering  Institute,  Pittsburgh,  Pennsylvania  and  the  Mitre 
Corporation,  Bedford,  Massachusetts,  which  provide  engineering  support 
to  the  Electronic  Systems  Center;  and  the  ECI  Division  of  E-Systems,  Inc., 
St.  Petersburg,  Florida,  the  prime  contractor  for  building  the  SCIS. 
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Briefing  Charts  and  Explanatory  Narrative 


In  1986  the  Congress  approved  the  development  of  SCIS.  The  estimated 
cost  for  the  program  at  that  time  was  $142  million.  Since  that  time,  costs 
have  steadily  escalated.  In  September  1989,  the  Air  Force  told  Defense  it 
would  need  $187  million  to  complete  the  program.  However,  according  to 
Air  Force  records,  this  estimate  did  not  include  costs  for  operations  and 
maintenance,  system  testing,  and  for  final  review  and  acceptance  by  the  Air 
Force.  At  that  time,  including  these  costs  would  have  brought  the  total 
estimated  cost  for  the  program  to  $199  million— an  increase  of  $57  million 
over  the  original  estimate. 

By  1992  costs  rose  to  $234  million  (a  $92  milUon  incre2ise  over  the 
original  cost  estimate).  This  increase  was  primarily  to  cover  the  cost  of 
acquiring  a  faster,  more  powerful  computer  platform  and  for  either 
reworking  existing  software  or  for  writing  new  software  for  use  on  the  new 
platform.  A  new  platform  was  necessary  because  the  computer  used  in  the 
original  design  was  unable  to  satisfy  revised  message  processing  work 
loads  and  other  quantitative  performance  requirements. 
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GAD  Program  Status-SCIS 
Schedule  Slip 
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SCIS  Schedule  Slip 


The  Air  Force  originally  planned  to  achieve  full  operational  capability  for 
this  system  in  September  1992.  This  date  has  now  slipped  to  November 
1995.  Some  reasons  for  this  program  slip,  discussed  later  in  this  report, 
include  (1)  prematmely  selected  computer  hardware  that  was  replaced 
with  larger,  more  powerful  models  and  (2)  the  Air  Force’s  decision  to 
redefine  missile  warning  message  requirements. 
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GAO  Program  Status— Prematurely 
Selected  Hardware 


Original  Schedule 
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Preliminary  Design  Review 
Critical  Design  Review 
sets  Hardware  Selection 
Tolerant  032 
Tolerant  332 
DEC  FT  410 
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1989 
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Prematurely  Selected 
Hardware 


In  August  1986,  the  Air  Force  contracted  with  the  ECI  Division  of 
E-Systems,  Inc.,  to  build  SCIS  based  on  a  design  that  used  Tolerant  Model 
032  computers.  This  design  was  approved  by  the  Air  Force  at  two  key 
program  decision  points— preliminary  design  review  in  August  1987  and 
critical  design  review  in  January  1988.  These  reviews  are  typically  done 
during  the  early  stages  of  system  development  to  provide  assurance  that 
the  system  being  built  will  satisfy  program  requirements. 

However,  the  Air  Force  did  not  validate  all  requirements  and  determine  the 
system’s  processing  work  load  prior  to  these  design  reviews.  Despite  this, 
the  Air  Force  allowed  the  contractor  to  proceed  with  the  program.  In 
January  1990,  2  years  after  critical  design  review,  the  Air  Force  determined 
that  SCIS  was  being  built  to  process  a  work  load  significantly  less  than  that 
needed  to  satisfy  mission  requirements.  The  Air  Force  then  directed  the 
contractor  to  build  SCIS  to  process  a  message  work  load  based  on  50 
percent  of  missile  laimches  from  known  launch  sites  and  50  percent  from 
unknown  launch  sites.  The  originally  approved  design  expected  only  5 
percent  of  missile  laimches  to  be  from  unknown  launch  sites.  Messages  on 
missiles  launched  from  unknown  sites  require  significantly  more  computer 
processing  capabihties  than  those  on  missiles  launched  from  known  sites. 

Failure  to  define  requirements  and  determine  the  processing  capability 
needed  has  resulted  in  two  replacements  of  the  computer  hardware.  The 
Tolerant  Model  032  was  upgraded  to  a  Tolerant  Model  332  in  February 
1989,  and  in  November  1991,  that  equipment  was  replaced  with  a  Digital 
Equipment  Corporation  Model  Fr410.  Air  Force  analyses  conducted  after 
the  Tolerant  upgrade  revealed  that  the  hardware  could  not  process  all 
required  data  and  could  not  process  the  data  fast  enough  to  meet  system 
requirements. 
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GAD  Program  Status-Sources  of 
Fault  Tolerant  System  Outages 
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Sources  of  Fault 
Tolerant  System 
Outages 


E-Systems,  Inc.,  is  designing  and  building  a  fault-tolerant  system,  that  is, 
one  that  will  be  available  most  of  the  time.  While  the  Air  Force  would  like 
the  system  to  run  continuously,  it  recognizes  that  there  will  be  a  certain 
amoimt  of  down  time  (the  estimated  amount  of  down  time  is  classified). 
According  to  Digital  Equipment  Corporation  studies,  system  failures  in 
fault-tolerant  systems  are  caused  by  hardware  problems  18  percent  of  the 
time;  software  errors  15  percent  of  the  time;  human  error  42  percent  of  the 
time;  and  problems  with  the  environment  (for  example,  cooling  or 
electrical  failures)  25  percent  of  the  time. 

In  November  1991,  when  E-Systems,  Inc.,  changed  hardware  platforms  to 
Digital  Equipment  Corporation  processors,  its  analysis  confirmed  that  the 
new  hardware  would  meet  the  operational  availability  required  in  the 
system  specification.  However,  E-Systems’  analysis  only  considered  down 
time  caused  by  hardware  problems.  Since  hardware  problems  are 
responsible  for  only  a  relatively  small  percentage  of  system  failures,  the  Air 
Force  cannot  be  certain  of  SCIS  availability  imtil  an  analysis  is  performed 
that  includes  all  causes  for  system  failures. 

E-Systems  is  developing  a  model  to  revalidate  system  availability.  This 
model  is  being  designed  to  assess  the  impacts  from  hardware  failures  and 
operating  system  and  application  software  errors.  It  does  not  consider 
impacts  from  errors  in  the  communications  system  software  or  from  down 
time  caused  by  human  error  and  problems  with  the  environment. 
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GAO  Program  Status— Reductions  in 
SCIS  Communications  Media 
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SCIS  was  designed  and  justified  to  the  Congress  as  a  system  to  process  and 
simultaneously  transmit  missile  attack  warning  messages  over  multiple 
communication  media  among  sensors,  the  Cheyenne  Mountain  Air  Force 
Base  and  the  Offutt  Processing  and  Correlation  Center,  and  several 
National  Command  Authority  locations.  Current  missile  attack  warning 
messages  are  transmitted  over  one  of  two  available  communications 
media-commercial  high-speed  telephone  lines  (CHS)  or  the  Jam  Resistant 
Secure  Communications  (JRSC)  satellite  system— messages  cannot  be  sent 
over  both  media  at  the  same  time.  Under  the  original  SCIS  concept,  all 
missile  warning  messages  would  be  simultaneously  transmitted  over  five 
media— the  two  mentioned  above  and  the  Military  Strategic  Tactical  and 
Relay  SateUite  Cormnunications  (milstar)  system,  the  Air  Force  Satellite 
Communications  (AFSATCOM)  system,  and  the  Ground  Wave  Emergency 
Network  (GWEN).  This  approach  was  thought  to  enhance  survivability 
because  some  media  would  continue  to  transmit  messages  even  if  others 
were  destroyed. 

In  September  1991,  the  Air  Force  decided  not  to  use  two  of  the  media. 
AFSATCOM  was  dropped  because  it  is  highly  susceptible  to  jamming  and  will 
not  be  able  to  commimicate  when  nuclear  weapons  are  exploding.  GWEN 
was  eliminated  because  other  higher  priority  messages  preempted  its 
availability  to  send  missile  attack  warning  information  and  because  its  area 
of  coverage  is  limited  to  the  continental  United  States.  SCIS  is  now  being 
designed  to  broadcast  messages  on  three  media.  Two— CHS  and  JRSC— are 
ciurently  used  to  communicate  missile  warning  information.  The  third, 
MILSTAR,  is  Defense’s  next-generation  satellite  communication  system  and 
is  expected  to  be  operational  several  years  after  SCIS  is  delivered. 

Air  Force  program  management  officials  from  the  Electronic  Systems 
Division  told  us  that  there  are  no  other  communication  media  available  and 
that  CHS,  JRSC,  and  milstar  will  be  able  to  do  the  job.  However,  these 
officials  also  told  us  that  CHS  is  the  least  survivable  media  and  in  all 
likelihood  would  be  the  first  to  go  down  during  a  nuclear  missile  attack. 
Under  this  scenario,  the  Air  Force  will  only  have  JRSC  to  provide  missile 
attack  warning  messages  until  MILSTAR  becomes  operational. 


Reductions  in  SCIS 
Communications  Media 
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